The invention relates to a management device collecting data from remote devices over a network. More particularly, the present invention relates to improving the accuracy of analysis of data collected from the remote devices over the network.
Network communications have become a fundamental part of today""s computing. It is not uncommon to find two or more computer systems working together to resolve issues such as simulations, modeling, forecasting, etc. In fact, these efforts have been so successful, users have been inclined to design and implement larger and more powerful networks.
As the networks grow larger, increasingly complex, and interface with a variety of diverse networks, it is the task of a network manager (or administrator/user) to keep track of the devices on the networks, to monitor performances and load, to diagnose, and to correct problems with the network.
To assist a network manager, network management software (xe2x80x9cNMSxe2x80x9d) may be used in the management of a network. The conventional NMS may be typically executed on a management device or node of the network. From the management node, the conventional NMS may be configured to determine a network topology, detect malfunctioning remote network devices or communication links, monitor network traffic, etc.
As part of the monitoring duties, the network manager may configure the NMS to occasionally query or poll remote network devices for information. The information may include status data, port information, address, etc. The information required may be crucial for the network manager to assess the overall status of the network.
FIG. 7 illustrates a block diagram of a conventional management node or device 700 implementing a conventional data collection from a remote node. In particular, the management node 700 includes a NMS 710 and a network interface 720. The NMS 710 may be configured to provide the functionality for a user, (e.g., a network manager), to manage a network 715 through the network interface 720.
As part of the NMS 710, the NMS 710 may include a data collector module 730 configured to retrieve user specified information at a scheduled time from remote devices 725a . . . 725n at a scheduled time over the network 715, a data collection event. The data collector module 730 may retrieve the selected information from at least one of the remote device 725a . . . 725n and store the selected information in an associated output file in the management node 700. The associated output file may be analyzed by additional network tools of the NMS 710 to assist in the assessment of the status and maintenance of the network 715.
In the analysis of the associated output file, the results of the analysis may be skewed. Typically, network systems experience regular patterns of network traffic, (i.e., data/command packets traversing a network). A typical pattern may be a high volume of network traffic during the morning hours of a work week as a result of (e.g., users checking their electronic mail in the morning), followed by a steady volume of network traffic for the rest of the day. The network traffic volume may subsequently drop during the evening hours as users end their respective work days.
However, a workday-week network traffic pattern may be markedly different than a weekend network traffic pattern where network traffic pattern may comprise of occasional network administration traffic (e.g., back-up, maintenance commands, etc.) along with an occasional weekend user. The weekend network traffic pattern may also be markedly different from a workweek overnight traffic pattern which may consist entirely of network administration traffic and/or time-intensive computations.
For example, if the results of the analysis are to be used to determine a performance threshold for incoming data, the performance threshold computation may be skewed. In typical performance threshold computation, most conventional network management systems use all the relevant collected data value points to calculate a given performance threshold. As a result, the given performance threshold may not take into account the varying network traffic patterns that may occur during a week or a given time period of the network. Accordingly, a weekend data point, which may not be aberration when compared against comparable weekend data points, is an aberration when compared against the combined data points.
The aberration may generate an alarms (or alerts) to a network manager. Since the alerts may been unnecessary, the unnecessary alerts may present an erroneous picture of the state of a network. As a result, a network manager may unnecessarily adjust performance parameters of the network to accommodate the unnecessary alarms, which may lead to an inefficient allocation of network resources. Additionally, the generation of unnecessary alarms may lead a network manager to assume that all alarms from the NMS are trivial. Thus, the network manager may ignore meaningful alarms that arrive from the NMS.
One solution to the generation of unnecessary alarms is a proposal where a sliding window of time is utilized to create the appropriate thresholds. The technique is fully described by U.S. Pat. No. 6,182,022 to Mayle et al., the subject matter of which is herein incorporated by reference.
In the Mayle technique, only collected data value points over a sliding window of time are used by a statistical analyzer to calculate a baseline for a monitored performance parameter or attribute. The baseline represents a normal operating range for the monitored performance parameter during the sliding window of time. The baseline is subsequently utilized to generate a new performance threshold. However, although the sliding window of time may take into account the varying amount of network traffic over time, the technique does not distinguish differences between network traffic patterns, which may still lead to an inaccurate picture of a network.
In accordance with one aspect, the present invention pertains to a method for improving accuracy of performance thresholds. The method includes configuring a plurality of time intervals and determining a received time interval of the plurality of time intervals in response to an incoming data value. The method further includes computing a revised threshold for the received time interval in response to the incoming data value and comparing the revised threshold and the incoming data value.
One aspect of the present invention is a method for improving accuracy of performance thresholds that includes allocating a plurality of memory blocks where each memory block corresponds to a time interval of a plurality of time intervals. The method also includes determining a received memory block of the plurality of memory blocks in response to an incoming data value and calculating a revised threshold for each memory block. The method further includes updating a plurality of revised thresholds for comparison against subsequent incoming data values.
Another aspect of the present invention is a system for monitoring that includes at least one processor, a memory coupled to said at least one processor, and a time-bucketing data collection module stored on said memory and executed on said at least one processor. The time-bucketing data collection module is configured to determine a received time interval of a plurality of time intervals in response to an incoming data value, to compute a revised threshold for the received time interval in response to the incoming data value, and to compare the revised threshold and the incoming data value.
Another aspect of the present invention is a method that includes establishing a plurality of time intervals and receiving one or more data values, where each data value having an associated time. The method also includes associating each of the one or more data values with one of the plurality of time intervals based on the associated time of each of the one or more data values. The method further includes calculating a parameter associated with a particular one of the time intervals as a function of those received data values associated only with the particular one of the time intervals.
Additional advantages and novel features of the invention will be set forth in part in the description which follows and in part will become apparent to those skilled in the art upon examination of the following or may be learned by practice of the invention.